Local Privilege Escalation in snapd

published 2026-03-17 7 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-12570

cvss: 7.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.4%; EPSS 1.4% chance of exploitation in 30 days, percentile 72%
public exploits: 1; Metasploit

Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.

Patch / fix

fixed in 5 distros 2

Canonical Ubuntu 16.04 LTS 2.61.4ubuntu0.16.04.1+esm2
Canonical Ubuntu 18.04 LTS 2.61.4ubuntu0.18.04.1+esm2
Canonical Ubuntu 20.04 LTS 2.67.1+20.04ubuntu1~esm1
Canonical Ubuntu 22.04 LTS 2.73+ubuntu22.04.1
Canonical Ubuntu 24.04 LTS 2.73+ubuntu24.04.2

debian ubuntu

snapd Debian 12 2.57.6-1+deb12u1
snapd Debian 13 2.68.3-3+deb13u1
snapd Debian 14 2.76-1

debian advisories DEBIAN-CVE-2026-3888

snapd Ubuntu 22.04 LTS 2.73+ubuntu22.04.1
snapd Ubuntu 24.04 LTS 2.73+ubuntu24.04.2
snapd Ubuntu 25.10 2.73+ubuntu25.10.1
snapd Ubuntu 26.04 LTS 2.74.1+ubuntu26.04.3
snapd Ubuntu Pro 16.04 LTS 2.61.4ubuntu0.16.04.1+esm2
snapd Ubuntu Pro 18.04 LTS 2.61.4ubuntu0.18.04.1+esm2
snapd Ubuntu Pro 20.04 LTS 2.67.1+20.04ubuntu1~esm1

ubuntu advisories UBUNTU-CVE-2026-3888

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-3888 updated 2026-06-28 cvss 7.8

snapd: Local Privilege Escalation in snapd

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

2026-03-17 First public exploit (Metasploit exploit/linux/local/cve_2026_3888)
2026-03-17 Published

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 7 mo ago (2026-03-17)

Exploit prediction

1.41% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/linux/local/cve_2026_3888 Local Privilege Escalation in snapd metasploit exploit, excellent rank, 2026-03-17

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.8	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

Canonical Ubuntu 16.04 LTS
Canonical Ubuntu 18.04 LTS
Canonical Ubuntu 20.04 LTS
Canonical Ubuntu 22.04 LTS
Canonical Ubuntu 24.04 LTS

Classification

Weakness

CWE-268 Privilege Chaining

References

ubuntu.com /security/notices/USN-8102-1
vendor-advisory, third-party-advisory
discourse.ubuntu.com /t/snapd-local-privilege-escalation-cve-2026-3888
technical-description, vendor-advisory, mitigation, third-party-advisory
ubuntu.com /security/CVE-2026-3888
vdb-entry, issue-tracking, third-party-advisory
blog.qualys.com /vulnerabilities-threat-research/2026/03/17/cve-2026-3888-important-snap-flaw-enables-local-privilege-escalati
technical-description, media-coverage, mitigation, third-party-advisory
cdn2.qualys.com /advisory/2026/03/17/snap-confine-systemd-tmpfiles.txt
technical-description, media-coverage, third-party-advisory
openwall.com /lists/oss-security/2026/03/18/1
mailing-list, third-party-advisory

Sources

CVE List CVE-2026-3888
NVD CVE-2026-3888

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary